ef6b339e62398f29567e5f84f97472a6adf49cb2af4136860b229f61011f0990

Analysis

max time kernel
141s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 12:47

Target

BTlink.exe
Size

2.0MB
MD5

9b23a2511cf70ded727402946cb7097c
SHA1

f989f80aa86925581777db843d7ae7dbe9c5c1b0
SHA256

3da6ab46118c2be121d3047af70a70f1ecd7cc95bb74f4a68274d7b626991801
SHA512

d60170006f54afe38f6bd5157aa4b8eef7fc52b9cbd91a80c3208f2fecff01724575173c39840629ede98a1343fe9131e72244cd63da6f6702a74867a127460c
SSDEEP

49152:G9HTONC9+ip/BlnEqxTUaw/iMIf/keAvK6SwWs6AWn1Hx24nTmB:Q6Nyr/LTbw+/6KfwV611Xw

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1968	BTlink.tmp

Loads dropped DLL 3 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1968	BTlink.tmp

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 1968	2204	BTlink.exe	28
PID 2204 wrote to memory of 1968	2204	BTlink.exe	28
PID 2204 wrote to memory of 1968	2204	BTlink.exe	28
PID 2204 wrote to memory of 1968	2204	BTlink.exe	28
PID 2204 wrote to memory of 1968	2204	BTlink.exe	28
PID 2204 wrote to memory of 1968	2204	BTlink.exe	28
PID 2204 wrote to memory of 1968	2204	BTlink.exe	28

\Users\Admin\AppData\Local\Temp\is-0TI03.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-NHTDM.tmp\BTlink.tmp

Filesize
694KB

MD5
ddb64d74512e9e2f246468209f3f41d8

SHA1
91d9026fb2269680d7e05e1b4cd4b47f84daf651

SHA256
90f4aaead5b4fe9a8f74c378c8e862bd3ea3dd772f9d9bbaa2d3ef230a05752d

SHA512
f8956fa29f6b84ca94eb1cc864483b0849a96c7a47091f2e75704b268881325cc60f9f73cf65418c0940f5b7bd0c50ee7660ad9c23514f09b127f2f1ee631299

Download Submit
memory/1968-7-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1968-15-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/1968-18-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2204-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2204-14-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download